Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13/09/2024, 19:05
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240802-en
General
-
Target
sample.html
-
Size
213KB
-
MD5
b6e8f8eb6befc5bd412cdf9b6fbfceee
-
SHA1
a4fe9c8e9152384b65596b83089549ce9a0d9ece
-
SHA256
68aa909099dc2de0f9d8f518a98b12052dc781a204475f5e247f98a957444bd1
-
SHA512
23d58d26d39dcd550915e57bc2cd6da47bc90474fe894159e3ab2a6d1b9b537f197ae2278964daae17c2deb8a4dadb721bde14dc3a138f54d7020e867aa744e0
-
SSDEEP
3072:SJv5COAWkeGpyfkMY+BES09JXAnyrZalI+YQ:SJnNQMsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 512 msedge.exe 512 msedge.exe 3884 msedge.exe 3884 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3884 msedge.exe 3884 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe 3884 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3884 wrote to memory of 3908 3884 msedge.exe 83 PID 3884 wrote to memory of 3908 3884 msedge.exe 83 PID 3884 wrote to memory of 232 3884 msedge.exe 84 PID 3884 wrote to memory of 232 3884 msedge.exe 84 PID 3884 wrote to memory of 232 3884 msedge.exe 84 PID 3884 wrote to memory of 232 3884 msedge.exe 84 PID 3884 wrote to memory of 232 3884 msedge.exe 84 PID 3884 wrote to memory of 232 3884 msedge.exe 84 PID 3884 wrote to memory of 232 3884 msedge.exe 84 PID 3884 wrote to memory of 232 3884 msedge.exe 84 PID 3884 wrote to memory of 232 3884 msedge.exe 84 PID 3884 wrote to memory of 232 3884 msedge.exe 84 PID 3884 wrote to memory of 232 3884 msedge.exe 84 PID 3884 wrote to memory of 232 3884 msedge.exe 84 PID 3884 wrote to memory of 232 3884 msedge.exe 84 PID 3884 wrote to memory of 232 3884 msedge.exe 84 PID 3884 wrote to memory of 232 3884 msedge.exe 84 PID 3884 wrote to memory of 232 3884 msedge.exe 84 PID 3884 wrote to memory of 232 3884 msedge.exe 84 PID 3884 wrote to memory of 232 3884 msedge.exe 84 PID 3884 wrote to memory of 232 3884 msedge.exe 84 PID 3884 wrote to memory of 232 3884 msedge.exe 84 PID 3884 wrote to memory of 232 3884 msedge.exe 84 PID 3884 wrote to memory of 232 3884 msedge.exe 84 PID 3884 wrote to memory of 232 3884 msedge.exe 84 PID 3884 wrote to memory of 232 3884 msedge.exe 84 PID 3884 wrote to memory of 232 3884 msedge.exe 84 PID 3884 wrote to memory of 232 3884 msedge.exe 84 PID 3884 wrote to memory of 232 3884 msedge.exe 84 PID 3884 wrote to memory of 232 3884 msedge.exe 84 PID 3884 wrote to memory of 232 3884 msedge.exe 84 PID 3884 wrote to memory of 232 3884 msedge.exe 84 PID 3884 wrote to memory of 232 3884 msedge.exe 84 PID 3884 wrote to memory of 232 3884 msedge.exe 84 PID 3884 wrote to memory of 232 3884 msedge.exe 84 PID 3884 wrote to memory of 232 3884 msedge.exe 84 PID 3884 wrote to memory of 232 3884 msedge.exe 84 PID 3884 wrote to memory of 232 3884 msedge.exe 84 PID 3884 wrote to memory of 232 3884 msedge.exe 84 PID 3884 wrote to memory of 232 3884 msedge.exe 84 PID 3884 wrote to memory of 232 3884 msedge.exe 84 PID 3884 wrote to memory of 232 3884 msedge.exe 84 PID 3884 wrote to memory of 512 3884 msedge.exe 85 PID 3884 wrote to memory of 512 3884 msedge.exe 85 PID 3884 wrote to memory of 1232 3884 msedge.exe 86 PID 3884 wrote to memory of 1232 3884 msedge.exe 86 PID 3884 wrote to memory of 1232 3884 msedge.exe 86 PID 3884 wrote to memory of 1232 3884 msedge.exe 86 PID 3884 wrote to memory of 1232 3884 msedge.exe 86 PID 3884 wrote to memory of 1232 3884 msedge.exe 86 PID 3884 wrote to memory of 1232 3884 msedge.exe 86 PID 3884 wrote to memory of 1232 3884 msedge.exe 86 PID 3884 wrote to memory of 1232 3884 msedge.exe 86 PID 3884 wrote to memory of 1232 3884 msedge.exe 86 PID 3884 wrote to memory of 1232 3884 msedge.exe 86 PID 3884 wrote to memory of 1232 3884 msedge.exe 86 PID 3884 wrote to memory of 1232 3884 msedge.exe 86 PID 3884 wrote to memory of 1232 3884 msedge.exe 86 PID 3884 wrote to memory of 1232 3884 msedge.exe 86 PID 3884 wrote to memory of 1232 3884 msedge.exe 86 PID 3884 wrote to memory of 1232 3884 msedge.exe 86 PID 3884 wrote to memory of 1232 3884 msedge.exe 86 PID 3884 wrote to memory of 1232 3884 msedge.exe 86 PID 3884 wrote to memory of 1232 3884 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe54e446f8,0x7ffe54e44708,0x7ffe54e447182⤵PID:3908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,10791097292317204080,16050035133257605130,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:22⤵PID:232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,10791097292317204080,16050035133257605130,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,10791097292317204080,16050035133257605130,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:82⤵PID:1232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,10791097292317204080,16050035133257605130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:4868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,10791097292317204080,16050035133257605130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:4132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,10791097292317204080,16050035133257605130,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1904 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2392
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1184
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4408
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ecf7ca53c80b5245e35839009d12f866
SHA1a7af77cf31d410708ebd35a232a80bddfb0615bb
SHA256882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687
SHA512706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696
-
Filesize
152B
MD54dd2754d1bea40445984d65abee82b21
SHA14b6a5658bae9a784a370a115fbb4a12e92bd3390
SHA256183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d
SHA51292d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1
-
Filesize
5KB
MD5e5b2c28c18fab8083e1d905a188780eb
SHA1247704a337f2f59cb9161270ecc24d6d8200f25b
SHA25639796b136e1951a59da03ca977c0af1c48811219956fbf4e5d7449075e3121b6
SHA5122e530db912187ae14db63296acbff42d364768131b4cdf909e3941861986b8e68c259f1d2b10253b0df87e54a1e1e6d427f6fd5cff40c003557f3afa1170fa93
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b7437bc6-a2db-47ae-a9d9-ec096d2e2f5b.tmp
Filesize6KB
MD528d64effbc13fbeaf4b2a0851ce53680
SHA1932777c02ff9dfe920219a4f542a3f2cc5121f0c
SHA2566192b88c118a2698256fbca63a274a5a8e9b9b5c6912b1022bb9fe209ee0faa9
SHA51200c1564199616d42da921aff7e94fa30bef41c066e05f0a5580e412609cd68a89fb22ce96d04034fc7cc390db4f214171e3b5a06f992915c4bcf42ed9da5cd12
-
Filesize
10KB
MD5113c0af50f2b761abf4d64223757fc8b
SHA162535e378ca96988394aa6d30c065c8194e320fd
SHA2564c5f81efee20ecdb1637a82e548b9e778b251ff373cc7bc8d788c109ee97a1be
SHA512d02e0b8937e2c55d029637503003903e5015267ff9262bd12426709713657d8b9ea1b6523f197ae5388264e207cdeefc7c10be0395d24a78b413638a830955dd